CVE-2009-1960: Code Injection
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via the configcascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1960?
CVE-2009-1960 has a moderate severity rating as it allows remote attackers to execute arbitrary local files if register_globals is enabled.
How do I fix CVE-2009-1960?
To fix CVE-2009-1960, disable register_globals in the PHP configuration and update to a secure version of DokuWiki.
Which versions of DokuWiki are affected by CVE-2009-1960?
CVE-2009-1960 affects DokuWiki versions rc2009-02-06, 2009-02-14, and rc2009-01-30.
Can CVE-2009-1960 lead to remote file inclusion?
Yes, CVE-2009-1960 can allow remote file inclusion if the server is running an affected version of DokuWiki with register_globals enabled.
What are the potential consequences of CVE-2009-1960?
The potential consequences of CVE-2009-1960 include unauthorized access to sensitive files and the execution of malicious code on the server.